A phishing attack has been reported against JavaScript library maintainers, during which a message was sent on behalf of the NPM service, notifying users to confirm their email. The attack allowed attackers to obtain NPM tokens from the maintainer of one of the major JavaScript projects and release updates with malicious code for five NPM packages, totaling around 100 million downloads per week.
The sent message was styled to resemble typical NPM notifications sent from the address "support@npmjs.org", but the link provided pointed to the domain "npnjs.com" instead of "npmjs.com" (the third letter was an "n" instead of an "m"). The attackers exploited a psychological effect, causing the brain to overlook minor distortions, such as replacing letters with similar ones or changing the order of letters in a word, as it anticipates the expected outcome. When the link was clicked, a full replica of the npmjs.com site opened (it is likely that a proxy was configured to intercept the access token).
During the attack, new package versions were created:
- eslint-config-prettier: 8.10.1, 9.1.1, 10.1.6, 10.1.7.
- eslint-plugin-prettier: 4.2.2, 4.2.3.
- synckit: 0.11.9.
- @pkgr/core: 0.2.8.
- napi-postinstall: 0.3.1.
Malicious code was added to the created releases to attack users utilizing the Windows platform. The changes made loaded the library node-gyp.dll, which contained functionality for remote command execution on the system.
The maintainer noticed that he had fallen victim to phishing about an hour after the first complaint was received regarding the publication of suspicious releases. He immediately revoked the access token, changed passwords, marked the problematic versions as deprecated to prevent downloads by automated build systems, and submitted a request to remove the problematic versions from the repository to NPM support.
It is unclear how many users managed to download the malicious versions (for example, the malicious version of the eslint-plugin-prettier package remained in the repository for about two days). Over the past week, the eslint-config-prettier package experienced 30 million downloads and was used as a dependency by 11,762 packages; the eslint-plugin-prettier package had 21 million downloads (8,468 dependent packages); synckit had 18 million downloads; @pkgr/core had 16 million downloads; and napi-postinstall had 10 million.
Source: opennet.ru
